Insider threat incident at Technology Company

Insider threat investigation — Technology company · anonymized case.

Background

SARAL TECH Pvt. Ltd. (anonymized) is a mid-sized technology firm building software for healthcare clients. They suspected an insider had accessed and shared sensitive client data with a competitor.

Problem

Confidentiality of client information and proprietary material was at risk. The company needed a technical investigation that could stand up to HR and legal review.

What I examined

Scope of the suspected breach and preservation of disk images and network logs
Forensic timeline work with EnCase (logins, file access, deleted-file recovery, outbound transfers)
Host and configuration visibility with Nessus as a vulnerability assessment tool — not as employee-activity monitoring

What the evidence showed

Access logs and related artifacts correlated the unauthorized activity with a specific user account. I reported technical findings in neutral person/account language.

What I recommended

Updated access controls and two-factor authentication (Google Authenticator)
Regular vulnerability audits with Nessus
Security and data-handling training for staff

Employment and legal decisions — including termination — were made by the company’s HR and legal teams, not by me.

Outcome

The responsible employee was identified. Access controls and audit practices were tightened. Sensitive case details remain confidential.